deepspace 0.17.0 → 0.19.0

package/dist/index.d.ts

@@ -1361,7 +1361,7 @@ declare function encode<M extends BaseMessage<string, unknown>>(message: M): str
  * Provides:
  * - WebSocket upgrade with Cloudflare hibernation API
  * - Connection tracking (WebSocket -> UserAttachment)
- * - Auth: parse JWT-verified user info from URL search params
+ * - Auth: parse JWT-verified user info from internal request headers
  * - Presence: connected users list, awareness on connect/disconnect
  * - Message routing: JSON parse -> dispatch by `type` field, binary hook
  * - Raw SQLite access via this.sql
@@ -1396,8 +1396,8 @@ interface ConnectionAttachment extends UserAttachment {
     subscriptions: Subscription[];
     /** Yjs docs this connection is editing */
     yjsSubscriptions: YjsSubscription[];
-    /** Client-side Yjs awareness clientId (extracted from first awareness message) */
-    awarenessClientId?: number;
+    /** Client-side Yjs awareness clientId for each subscribed document. */
+    awarenessClientIds?: Partial<Record<YjsDocKey, number>>;
 }
 /**
  * Context passed to handlers for accessing shared resources.
@@ -1418,6 +1418,8 @@ interface HandlerContext {
 /** Asset-layer misses became real 404s, and the worker owns the fallback. The
  *  config and the worker's fallback path have to move together. */
 declare const WORKER_OWNED_NOT_FOUND_MIGRATION_ID = "2026-08-worker-owned-not-found";
+/** Room identity moved to internal headers and privileged room routes gained app-role checks. */
+declare const SECURE_ROOM_BOUNDARIES_MIGRATION_ID = "2026-08-secure-room-boundaries";
 type AppMigrationIdsValidation = {
     valid: true;
     ids: string[];
@@ -3065,6 +3067,8 @@ declare function useQuery<T = unknown>(collection: string, options?: {
  * ```
  */
 declare function useMutations<T = unknown>(collection: string): {
+    /** True once the collection's RecordRoom can accept writes. */
+    ready: boolean;
     create: (data: T) => Promise<string>;
     put: (recordId: string, data: Partial<T>) => Promise<void>;
     remove: (recordId: string) => Promise<void>;
@@ -3073,6 +3077,12 @@ declare function useMutations<T = unknown>(collection: string): {
     removeConfirmed: (recordId: string) => Promise<void>;
 };
 
+/** A write was attempted before its RecordRoom connection became ready. */
+declare class RecordRoomNotReadyError extends Error {
+    readonly code = "not_ready";
+    constructor(collection?: string);
+}
+
 /**
  * useUsers Hook
  *
@@ -3220,7 +3230,7 @@ declare function usePresence(opts?: UsePresenceOptions): {
  * Uses the shared yjs-protocol.ts encoding — no duplication.
  *
  * @example
- * const { doc, text, setText, synced, canWrite } = useYjsRoom(docId, 'content')
+ * const { doc, text, setText, connected, synced, canWrite } = useYjsRoom(docId, 'content')
  */
 
 interface UseYjsRoomResult {
@@ -3232,6 +3242,8 @@ interface UseYjsRoomResult {
     text: string;
     /** Set text (replaces full content) */
     setText: (value: string) => void;
+    /** Whether the current WebSocket transport is open */
+    connected: boolean;
     /** Whether initial sync is complete */
     synced: boolean;
     /** Whether user has write access */
@@ -3432,7 +3444,7 @@ declare function useJobs<P = unknown, R = unknown>(roomId: string): UseJobsResul
  * Opens a WebSocket to /ws/presence/:scopeId for real-time presence tracking.
  * Use with any scope: canvas, doc, thread, page, etc.
  *
- * Peers can share arbitrary state (cursor position, typing indicator,
+ * Peers can share small ephemeral state (cursor position, typing indicator,
  * viewport, selection) via updateState().
  *
  * @example
@@ -3451,8 +3463,6 @@ declare function useJobs<P = unknown, R = unknown>(roomId: string): UseJobsResul
 interface PresencePeerClient {
     userId: string;
     userName: string;
-    userEmail: string;
-    userImageUrl?: string;
     joinedAt: string;
     state: Record<string, unknown>;
 }
@@ -4839,4 +4849,4 @@ declare const ACCOUNT_STORAGE_LIMIT_BYTES: {
 declare function storageLimitForTier(tier: string | null | undefined): number;
 declare function formatBytes(bytes: number): string;
 
-export { ACCOUNT_STORAGE_LIMIT_BYTES, APP_LOG_EVENT_KEYS, ASYNC_RESOURCE_DEFAULTS, type AdHocChargeOpts, type AiStreamAction, type AiStreamChunk, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMigrationIdsValidation, type AsyncResourceDefaults, type AsyncResourceState, type AsyncResourceStatus, AuthGate, type AuthGateProps, AuthOverlay, Awareness, type AwarenessState, type AwarenessStates, type BaseMessage, type CanvasShapeClient, type Channel, type ChannelInvitation, type ChannelMember, type ChargeOnceOpts, type ChargeOnceResult, type ClientErrorKind, type ClientErrorReport, type ClientErrorReporterOptions, type ClientMessage, type CollectionSchema, type ConnectionAttachment, type ConnectionStatus, type ContentSegment, type ConversationObject, type CronHistoryEntry, type CronTaskState, DEEPSPACE_AGENT_PROFILES, DEEPSPACE_AI_DEFAULTS, DEEPSPACE_AI_MODELS, DEEPSPACE_MODEL_CATALOG_PROVENANCE, DEEPSPACE_THEME_PROPERTIES, DEFAULT_USER_COLORS, type DeepSpaceAIModel, type DeepSpaceAIModelId, type DeepSpaceAIProvider, type DeepSpaceAgentProfile, type DeepSpaceAgentProfileId, type DeepSpaceAgentSupport, DeepSpaceAuthProvider, type DeepSpaceThemeConfig, DeepSpaceThemeProvider, type DeepSpaceThemeProviderProps, type DeriveLoadStateInput, ENV, type Environment, type FileAttachment, type GroupedReaction, GuestBanner, type HandlerContext, type InboxEntry, type IntegrationResponse, type JobStatusView, type JobView, LOG_LEVELS, type LinkPreviewData, type LoadState, type LoadStateAuthInput, type LoadStateStatusInput, type LogLevel, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MemberRecord, type Message, type MessageHandlers, type MessageRecord, type MsgType, type PagedResourceFetchArgs, type PagedResourcePage, type PagedResourceState, type PagedResourceStatus, type PlanInfo, PlatformContext, type PlatformContextValue, PlatformProvider, type PlatformWSOptions, type PlatformWSResult, type PresencePeerClient, PricingTable, type PricingTablePlan, type PricingTablePrice, type ProductChargeOpts, type ProtocolMessage, type Purchase, type Query, type R2FileInfo, type R2Scope, type R2UploadResult, ROLES, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_CONFIG, ROLE_DEFAULT, type Reaction, type ReactionRecord, type ReadCursorRecord, type ReadReceipt, type RecordData, RecordProvider, type RecordProviderProps, RecordScope, type RequestOptions, type ResolvedDeepSpaceAgentModel, type Role, type RoomUser, type ScopeEntry, ScopeRegistryProvider, type ServerMessage, SignedIn, SignedOut, type SubscribeOpts, type SubscribeResult, type SubscriptionState, type SubscriptionStatus, type SyncResult, type UseAsyncResourceOptions, type UseAuthProfileReadyOptions, type UseAuthStatusOptions, type UseCanvasResult, type UseCheckoutOpts, type UseCronMonitorResult, type UseJobsResult, type UsePagedResourceOptions, type UsePresenceRoomResult, type UseR2FilesReturn, type UseVoiceAgentOptions, type UseVoiceAgentResult, type UseYjsFieldResult, type UseYjsRoomResult, type UseYjsTextResult, type User, type UserCredits, type UserInfo, type UserKarma, type UserProfile, type ViewportClient, type VoiceStatus, type VoiceTranscriptEntry, WORKER_OWNED_NOT_FOUND_MIGRATION_ID, type WriteError, applyDeepSpaceTheme, applyUIThemeTokens, authClient, canAutoLoadPagedResource, clampPagedResourceItems, clearAuthToken, clearDeepSpaceTheme, clientBuild, createDecoder, createEncoder, decodeAiStreamChunk, deriveLoadState, detectEnvironment, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, formatBytes, formatFileSize, formatFullTimestamp, formatMessageTime, getApiUrl, getAuthToken, getAuthUrl, getConversationDisplayName, getConversationParticipantIds, getDeepSpaceAIModel, getEnvironmentConfig, getMessageType, getPagedResourceCooldownMs, getPlatformWorkerUrl, getThreadCounts, getUserColor, groupReactionsForMessage, handleAwarenessMessage, handleSyncMessage, hasContent, installClientErrorReporter, integration, isAsyncResourceSlow, isDMConversation, isDarkColor, isImageFile, isLocalDev, isProduction, listDeepSpaceAgentModels, parseMessageMetadata, parseSseLine, readThemeFromDOM, readVarUint, readVarUint8Array, reportClientError, resetEnvironmentCache, resolveDeepSpaceAgentModel, serverBuild, shouldGroupMessages, signIn, signOut, storageLimitForTier, toConnectionStatus, toUint8Array, useAsyncResource, useAuth, useAuthProfileReady, useAuthStatus, useAuthUser, useCanvas, useChannelMembers, useChannels, useCheckout, useCommunities, useConversation, useConversations, useCronMonitor, useDisplayName, useInbox, useIsDarkTheme, useJobs, useMessages, useMutations, usePagedResource, usePlatform, usePlatformWS, usePosts, usePresence, usePresenceRoom, useQuery, useR2Files, useReactions, useReadReceipts, useRecordContext, useSession, useSubscription, useUser, useUserLookup, useUsers, useVoiceAgent, useYjsField, useYjsRoom, useYjsText, validateAppMigrationIds, writeVarUint, writeVarUint8Array };
+export { ACCOUNT_STORAGE_LIMIT_BYTES, APP_LOG_EVENT_KEYS, ASYNC_RESOURCE_DEFAULTS, type AdHocChargeOpts, type AiStreamAction, type AiStreamChunk, type AppLogEvent, type AppLogEventKey, type AppLogsResponse, type AppMigrationIdsValidation, type AsyncResourceDefaults, type AsyncResourceState, type AsyncResourceStatus, AuthGate, type AuthGateProps, AuthOverlay, Awareness, type AwarenessState, type AwarenessStates, type BaseMessage, type CanvasShapeClient, type Channel, type ChannelInvitation, type ChannelMember, type ChargeOnceOpts, type ChargeOnceResult, type ClientErrorKind, type ClientErrorReport, type ClientErrorReporterOptions, type ClientMessage, type CollectionSchema, type ConnectionAttachment, type ConnectionStatus, type ContentSegment, type ConversationObject, type CronHistoryEntry, type CronTaskState, DEEPSPACE_AGENT_PROFILES, DEEPSPACE_AI_DEFAULTS, DEEPSPACE_AI_MODELS, DEEPSPACE_MODEL_CATALOG_PROVENANCE, DEEPSPACE_THEME_PROPERTIES, DEFAULT_USER_COLORS, type DeepSpaceAIModel, type DeepSpaceAIModelId, type DeepSpaceAIProvider, type DeepSpaceAgentProfile, type DeepSpaceAgentProfileId, type DeepSpaceAgentSupport, DeepSpaceAuthProvider, type DeepSpaceThemeConfig, DeepSpaceThemeProvider, type DeepSpaceThemeProviderProps, type DeriveLoadStateInput, ENV, type Environment, type FileAttachment, type GroupedReaction, GuestBanner, type HandlerContext, type InboxEntry, type IntegrationResponse, type JobStatusView, type JobView, LOG_LEVELS, type LinkPreviewData, type LoadState, type LoadStateAuthInput, type LoadStateStatusInput, type LogLevel, MSG, MSG_AWARENESS, MSG_SYNC, MSG_SYNC_STEP1, MSG_SYNC_STEP2, MSG_SYNC_UPDATE, MSG_YJS_AWARENESS, MSG_YJS_SYNC, type MemberRecord, type Message, type MessageHandlers, type MessageRecord, type MsgType, type PagedResourceFetchArgs, type PagedResourcePage, type PagedResourceState, type PagedResourceStatus, type PlanInfo, PlatformContext, type PlatformContextValue, PlatformProvider, type PlatformWSOptions, type PlatformWSResult, type PresencePeerClient, PricingTable, type PricingTablePlan, type PricingTablePrice, type ProductChargeOpts, type ProtocolMessage, type Purchase, type Query, type R2FileInfo, type R2Scope, type R2UploadResult, ROLES, ROLE_ADMIN, ROLE_ANONYMOUS, ROLE_CONFIG, ROLE_DEFAULT, type Reaction, type ReactionRecord, type ReadCursorRecord, type ReadReceipt, type RecordData, RecordProvider, type RecordProviderProps, RecordRoomNotReadyError, RecordScope, type RequestOptions, type ResolvedDeepSpaceAgentModel, type Role, type RoomUser, SECURE_ROOM_BOUNDARIES_MIGRATION_ID, type ScopeEntry, ScopeRegistryProvider, type ServerMessage, SignedIn, SignedOut, type SubscribeOpts, type SubscribeResult, type SubscriptionState, type SubscriptionStatus, type SyncResult, type UseAsyncResourceOptions, type UseAuthProfileReadyOptions, type UseAuthStatusOptions, type UseCanvasResult, type UseCheckoutOpts, type UseCronMonitorResult, type UseJobsResult, type UsePagedResourceOptions, type UsePresenceRoomResult, type UseR2FilesReturn, type UseVoiceAgentOptions, type UseVoiceAgentResult, type UseYjsFieldResult, type UseYjsRoomResult, type UseYjsTextResult, type User, type UserCredits, type UserInfo, type UserKarma, type UserProfile, type ViewportClient, type VoiceStatus, type VoiceTranscriptEntry, WORKER_OWNED_NOT_FOUND_MIGRATION_ID, type WriteError, applyDeepSpaceTheme, applyUIThemeTokens, authClient, canAutoLoadPagedResource, clampPagedResourceItems, clearAuthToken, clearDeepSpaceTheme, clientBuild, createDecoder, createEncoder, decodeAiStreamChunk, deriveLoadState, detectEnvironment, dispatch, encode, encodeAwarenessMessage, encodeSyncStep1, encodeSyncStep2, encodeUpdate, formatBytes, formatFileSize, formatFullTimestamp, formatMessageTime, getApiUrl, getAuthToken, getAuthUrl, getConversationDisplayName, getConversationParticipantIds, getDeepSpaceAIModel, getEnvironmentConfig, getMessageType, getPagedResourceCooldownMs, getPlatformWorkerUrl, getThreadCounts, getUserColor, groupReactionsForMessage, handleAwarenessMessage, handleSyncMessage, hasContent, installClientErrorReporter, integration, isAsyncResourceSlow, isDMConversation, isDarkColor, isImageFile, isLocalDev, isProduction, listDeepSpaceAgentModels, parseMessageMetadata, parseSseLine, readThemeFromDOM, readVarUint, readVarUint8Array, reportClientError, resetEnvironmentCache, resolveDeepSpaceAgentModel, serverBuild, shouldGroupMessages, signIn, signOut, storageLimitForTier, toConnectionStatus, toUint8Array, useAsyncResource, useAuth, useAuthProfileReady, useAuthStatus, useAuthUser, useCanvas, useChannelMembers, useChannels, useCheckout, useCommunities, useConversation, useConversations, useCronMonitor, useDisplayName, useInbox, useIsDarkTheme, useJobs, useMessages, useMutations, usePagedResource, usePlatform, usePlatformWS, usePosts, usePresence, usePresenceRoom, useQuery, useR2Files, useReactions, useReadReceipts, useRecordContext, useSession, useSubscription, useUser, useUserLookup, useUsers, useVoiceAgent, useYjsField, useYjsRoom, useYjsText, validateAppMigrationIds, writeVarUint, writeVarUint8Array };

package/dist/index.js

@@ -749,6 +749,7 @@ function encode(message) {
 var APP_MIGRATION_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/;
 var MAX_APP_MIGRATION_IDS = 256;
 var WORKER_OWNED_NOT_FOUND_MIGRATION_ID = "2026-08-worker-owned-not-found";
+var SECURE_ROOM_BOUNDARIES_MIGRATION_ID = "2026-08-secure-room-boundaries";
 function validateAppMigrationIds(value) {
   if (!Array.isArray(value)) {
     return { valid: false, reason: "app migrations must be a JSON string array" };
@@ -1688,6 +1689,17 @@ function reconnectDelayMs(attempt) {
   return Math.min(1e3 * Math.pow(2, attempt), 3e4);
 }
 
+// src/client/storage/errors.ts
+var RecordRoomNotReadyError = class extends Error {
+  code = "not_ready";
+  constructor(collection) {
+    super(
+      collection ? `RecordRoom is not ready for "${collection}" writes.` : "RecordRoom is not ready for writes."
+    );
+    this.name = "RecordRoomNotReadyError";
+  }
+};
+
 // src/client/storage/serverErrors.ts
 function humanizeCollection(slug) {
   return slug.replace(/^rbac-/, "").split(/[-_]/).map((w) => w.charAt(0).toUpperCase() + w.slice(1)).join(" ");
@@ -1786,6 +1798,8 @@ function parseServerError(error) {
 // src/client/storage/record-socket.ts
 var WS_CONNECTING = 0;
 var WS_OPEN = 1;
+var PING_EVERY_MS = 15e3;
+var PONG_TIMEOUT_MS = 3e4;
 var RecordSocket = class {
   constructor(config) {
     this.config = config;
@@ -1801,6 +1815,14 @@ var RecordSocket = class {
   pendingRequests = /* @__PURE__ */ new Map();
   reconnectAttempt = 0;
   reconnectTimeout = null;
+  heartbeat = null;
+  /** Any inbound frame proves the peer is answering. */
+  lastInboundAt = 0;
+  /** Monotonic time of the one probe awaiting an inbound answer. */
+  outstandingPingAt = null;
+  /** Monotonic time of the prior heartbeat callback. A long gap means the
+   *  scheduler was suspended, so a pre-suspension probe cannot be judged. */
+  lastHeartbeatCheckAt = 0;
   // Bumped by connect() (on entry) and disconnect()/destroy(). connect()
   // captures it before awaiting the auth token and re-checks after; a
   // mismatch means a teardown (or a newer connect) raced in during the
@@ -1849,10 +1871,12 @@ var RecordSocket = class {
     ws.onopen = () => {
       config.log?.("connected", config.roomId);
       config.listeners.onStatus("connected");
+      this.startHeartbeat(ws);
       this.resubscribeAll(ws);
     };
     ws.onmessage = (event) => this.handleMessage(event);
     ws.onclose = () => {
+      this.stopHeartbeat();
       config.log?.("disconnected", config.roomId);
       config.listeners.onStatus("disconnected");
       config.listeners.onReady(false);
@@ -1907,8 +1931,48 @@ var RecordSocket = class {
       this.reconnectTimeout = null;
     }
   }
+  /**
+   * Turn a peer that stopped answering into a `close` event. That is the whole
+   * job — `onclose` already reports 'disconnected', marks every query stale,
+   * and reconnects with backoff. Without this it is never called, because
+   * nothing about the connection is actually broken.
+   */
+  startHeartbeat(ws) {
+    this.stopHeartbeat();
+    this.lastInboundAt = performance.now();
+    this.lastHeartbeatCheckAt = this.lastInboundAt;
+    this.outstandingPingAt = null;
+    this.heartbeat = setInterval(() => {
+      if (ws.readyState !== WS_OPEN) return;
+      const now = performance.now();
+      const callbackGap = now - this.lastHeartbeatCheckAt;
+      this.lastHeartbeatCheckAt = now;
+      if (this.outstandingPingAt !== null) {
+        if (now - this.outstandingPingAt >= PONG_TIMEOUT_MS) {
+          if (callbackGap >= PONG_TIMEOUT_MS) {
+            ws.send("ping");
+            this.outstandingPingAt = now;
+          } else {
+            ws.close();
+          }
+        }
+        return;
+      }
+      if (now - this.lastInboundAt >= PING_EVERY_MS) {
+        ws.send("ping");
+        this.outstandingPingAt = now;
+      }
+    }, PING_EVERY_MS);
+  }
+  stopHeartbeat() {
+    if (this.heartbeat) clearInterval(this.heartbeat);
+    this.heartbeat = null;
+    this.outstandingPingAt = null;
+    this.lastHeartbeatCheckAt = 0;
+  }
   /** Close without firing onclose — prevents the zombie-reconnect. */
   teardownSocket() {
+    this.stopHeartbeat();
     const ws = this.ws;
     if (!ws) return;
     this.config.log?.("closing", this.config.roomId);
@@ -1930,7 +1994,7 @@ var RecordSocket = class {
   sendConfirmed(message, timeoutMs = 1e4) {
     const ws = this.ws;
     if (!ws || ws.readyState !== WS_OPEN) {
-      return Promise.reject(new Error("WebSocket not connected"));
+      return Promise.reject(new RecordRoomNotReadyError());
     }
     const requestId = `${Date.now()}-${Math.random().toString(36).slice(2, 9)}`;
     return new Promise((resolve, reject) => {
@@ -1977,6 +2041,9 @@ var RecordSocket = class {
     }
   }
   handleMessage(event) {
+    this.lastInboundAt = performance.now();
+    this.outstandingPingAt = null;
+    if (event.data === "pong") return;
     if (event.data instanceof ArrayBuffer) {
       this.binaryHandlers.forEach((h) => h(event.data));
       return;
@@ -2010,10 +2077,17 @@ var RecordSocket = class {
       }
       case MSG.RECORD_CHANGE: {
         const { collection, record, changeType } = payload;
-        for (const queryKey of this.subscriptions.values()) {
+        for (const [subscriptionId, queryKey] of this.subscriptions) {
           try {
             const query = JSON.parse(queryKey);
             if (query.collection !== collection) continue;
+            if (query.orderBy !== void 0 || query.limit !== void 0) {
+              this.sendMessage({
+                type: MSG.SUBSCRIBE,
+                payload: { subscriptionId, query }
+              });
+              continue;
+            }
             const matches = recordMatchesWhere(record, query.where);
             const exists = store.hasRecord(queryKey, record.recordId);
             if (changeType === "delete") {
@@ -2201,7 +2275,7 @@ function ScopeConnection({
   const sendConfirmed = useCallback3(
     (message, timeoutMs = 1e4) => {
       const socket = socketRef.current;
-      if (!socket) return Promise.reject(new Error("WebSocket not connected"));
+      if (!socket) return Promise.reject(new RecordRoomNotReadyError());
       return socket.sendConfirmed(message, timeoutMs);
     },
     []
@@ -2434,33 +2508,41 @@ function useMutations(collection) {
   const preferLocal = recordCtx?.registeredCollections?.has(collection) ?? false;
   const sendMessage = preferLocal ? recordCtx.sendMessage : scopeEntry?.sendMessage ?? recordCtx?.sendMessage;
   const sendConfirmed = preferLocal ? recordCtx.sendConfirmed : scopeEntry?.sendConfirmed ?? recordCtx?.sendConfirmed;
+  const ready = preferLocal ? recordCtx.ready : scopeEntry?.ready ?? recordCtx?.ready ?? false;
   if (!sendMessage || !sendConfirmed) {
     throw new Error(
       `useMutations('${collection}'): No scope found. Wrap this hook in a RecordScope that registers the collection.`
     );
   }
+  const assertReady = useCallback5(() => {
+    if (!ready) throw new RecordRoomNotReadyError(collection);
+  }, [ready, collection]);
   const create = useCallback5(
     async (data) => {
+      assertReady();
       const recordId = `${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
       sendMessage({ type: MSG.PUT, payload: { collection, recordId, data } });
       return recordId;
     },
-    [sendMessage, collection]
+    [assertReady, sendMessage, collection]
   );
   const put = useCallback5(
     async (recordId, data) => {
+      assertReady();
       sendMessage({ type: MSG.PUT, payload: { collection, recordId, data } });
     },
-    [sendMessage, collection]
+    [assertReady, sendMessage, collection]
   );
   const remove = useCallback5(
     async (recordId) => {
+      assertReady();
       sendMessage({ type: MSG.DELETE, payload: { collection, recordId } });
     },
-    [sendMessage, collection]
+    [assertReady, sendMessage, collection]
   );
   const createConfirmed = useCallback5(
     async (data) => {
+      assertReady();
       const recordId = `${Date.now()}-${Math.random().toString(36).slice(2, 11)}`;
       await sendConfirmed({
         type: MSG.PUT,
@@ -2468,26 +2550,28 @@ function useMutations(collection) {
       });
       return recordId;
     },
-    [sendConfirmed, collection]
+    [assertReady, sendConfirmed, collection]
   );
   const putConfirmed = useCallback5(
     async (recordId, data) => {
+      assertReady();
       await sendConfirmed({
         type: MSG.PUT,
         payload: { collection, recordId, data }
       });
     },
-    [sendConfirmed, collection]
+    [assertReady, sendConfirmed, collection]
   );
   const removeConfirmed = useCallback5(
     async (recordId) => {
+      assertReady();
       await sendConfirmed({ type: MSG.DELETE, payload: { collection, recordId } });
     },
-    [sendConfirmed, collection]
+    [assertReady, sendConfirmed, collection]
   );
   return useMemo6(
-    () => ({ create, put, remove, createConfirmed, putConfirmed, removeConfirmed }),
-    [create, put, remove, createConfirmed, putConfirmed, removeConfirmed]
+    () => ({ ready, create, put, remove, createConfirmed, putConfirmed, removeConfirmed }),
+    [ready, create, put, remove, createConfirmed, putConfirmed, removeConfirmed]
   );
 }
 
@@ -2747,6 +2831,7 @@ import { useState as useState7, useEffect as useEffect10, useLayoutEffect as use
 import * as Y3 from "yjs";
 var UPDATE_BATCH_DELAY_MS = 16;
 function useYjsRoom(docId, fieldName) {
+  const [connected, setConnected] = useState7(false);
   const [syncedDocId, setSyncedDocId] = useState7(null);
   const [canWrite, setCanWrite] = useState7(false);
   const [writeAuthResolved, setWriteAuthResolved] = useState7(false);
@@ -2782,6 +2867,7 @@ function useYjsRoom(docId, fieldName) {
     };
   }, [awareness, doc]);
   useLayoutEffect2(() => {
+    setConnected(false);
     setSyncedDocId(null);
     setCanWrite(false);
     setWriteAuthResolved(false);
@@ -2799,31 +2885,44 @@ function useYjsRoom(docId, fieldName) {
     let ws = null;
     let reconnectTimer = null;
     let alive = true;
+    let browserOnline = typeof navigator === "undefined" || navigator.onLine;
+    let connecting = false;
     const renewLocalAwareness = () => {
       const localState = awareness.getLocalState();
       if (localState) awareness.setLocalState(localState);
     };
     const connect = async () => {
-      if (!alive) return;
+      if (!alive || !browserOnline) return;
+      if (connecting) return;
+      if (ws?.readyState === WebSocket.CONNECTING || ws?.readyState === WebSocket.OPEN) return;
+      connecting = true;
       setCanWrite(false);
       setWriteAuthResolved(false);
       renewLocalAwareness();
-      const token = await getAuthToken();
-      if (!alive) return;
+      let token;
+      try {
+        token = await getAuthToken();
+      } finally {
+        connecting = false;
+      }
+      if (!alive || !browserOnline) return;
       const protocol = window.location.protocol === "https:" ? "wss:" : "ws:";
       const baseUrl = `${protocol}//${window.location.host}`;
       const url = new URL(`/ws/yjs/${encodeURIComponent(docId)}`, baseUrl);
       if (token) url.searchParams.set("token", token);
       wsLog("connecting", `yjs:${docId}`);
-      ws = new WebSocket(url.toString());
-      ws.binaryType = "arraybuffer";
-      wsRef.current = ws;
-      ws.onopen = () => {
+      const socket = new WebSocket(url.toString());
+      ws = socket;
+      socket.binaryType = "arraybuffer";
+      wsRef.current = socket;
+      socket.onopen = () => {
+        if (ws !== socket) return socket.close();
         wsLog("connected", `yjs:${docId}`);
+        setConnected(true);
         setSyncedDocId(null);
         renewLocalAwareness();
       };
-      ws.onmessage = (event) => {
+      socket.onmessage = (event) => {
         if (typeof event.data === "string") {
           try {
             const msg = JSON.parse(event.data);
@@ -2848,7 +2947,7 @@ function useYjsRoom(docId, fieldName) {
               writeVarUint(enc, MSG_SYNC);
               writeVarUint(enc, MSG_SYNC_STEP2);
               writeVarUint8Array(enc, diff);
-              ws?.send(toUint8Array(enc).buffer);
+              socket.send(toUint8Array(enc).buffer);
               setSyncedDocId(docId);
               break;
             }
@@ -2876,21 +2975,40 @@ function useYjsRoom(docId, fieldName) {
           }
         }
       };
-      ws.onclose = () => {
+      socket.onclose = () => {
+        if (ws !== socket) return;
         wsLog("disconnected", `yjs:${docId}`);
+        ws = null;
         wsRef.current = null;
+        setConnected(false);
         setSyncedDocId(null);
         setCanWrite(false);
         setWriteAuthResolved(false);
-        if (alive) reconnectTimer = setTimeout(connect, 1e3);
+        if (alive && browserOnline) reconnectTimer = setTimeout(connect, 1e3);
       };
-      ws.onerror = () => ws?.close();
+      socket.onerror = () => socket.close();
     };
-    connect();
+    const handleOffline = () => {
+      browserOnline = false;
+      setConnected(false);
+      setSyncedDocId(null);
+      setCanWrite(false);
+      setWriteAuthResolved(false);
+      ws?.close();
+    };
+    const handleOnline = () => {
+      browserOnline = true;
+      void connect();
+    };
+    window.addEventListener("offline", handleOffline);
+    window.addEventListener("online", handleOnline);
+    void connect();
     return () => {
       wsLog("closing", `yjs:${docId}`);
       alive = false;
       if (reconnectTimer) clearTimeout(reconnectTimer);
+      window.removeEventListener("offline", handleOffline);
+      window.removeEventListener("online", handleOnline);
       flushPendingUpdate(ws);
       if (ws) {
         ws.onclose = null;
@@ -2947,7 +3065,7 @@ function useYjsRoom(docId, fieldName) {
     },
     [doc, yText, canWrite]
   );
-  return { doc, awareness, text, setText, synced, canWrite, writeAuthResolved };
+  return { doc, awareness, text, setText, connected, synced, canWrite, writeAuthResolved };
 }
 
 // src/client/storage/hooks/useCanvas.ts
@@ -3215,6 +3333,9 @@ function useJobs(roomId) {
       ws.onopen = () => setConnected(true);
       ws.onmessage = (event) => {
         dispatch(event.data, {
+          [MSG.AUTH]: (p) => {
+            if (!p.canWrite) rejectAllPending(new Error("JobRoom write access denied"));
+          },
           [MSG.JOB_UPDATE]: (p) => {
             if (p.kind === "snapshot" && Array.isArray(p.jobs)) {
               setJobs(p.jobs);
@@ -6208,7 +6329,9 @@ export {
   ROLE_CONFIG,
   ROLE_DEFAULT,
   RecordProvider,
+  RecordRoomNotReadyError,
   RecordScope,
+  SECURE_ROOM_BOUNDARIES_MIGRATION_ID,
   ScopeRegistryProvider,
   SignedIn,
   SignedOut,